Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2017-3515)

The remote Oracle Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2017-3515 advisory. - crypto: algifhash - Only export and import on sockets with data Herbert Xu Orabug: 25417805 CVE-2016-8646 - USB: usbfs: fix potential infoleak in...

Ubuntu 16.04 LTS : Nova-LXD vulnerability (USN-3195-1)

The remote Ubuntu 16.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-3195-1 advisory. James Page discovered that Nova-LXD incorrectly set up virtual network devices when creating LXD instances. This could result in an unintended firewall...

Fedora 25 : bitlbee (2017-deb82f0c0d)

BitlBee 3.5.1 30 Jan 2017 =========================== - purple: Fix crash on file transfer requests from unknown contacts. This was the result of an incomplete fix in the previous release and may result in remote DoS. Read the full security advisory at: https://bugs.bitlbee.org/ticket/1282 - Afte...

Tenable Nessus < 6.9 XSS Vulnerability

Tenable Nessus is prone to a stored cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Fedora 25 : phpMyAdmin (2017-360e912fdb)

Welcome to phpMyAdmin 4.6.6, a release containing security and bug fixes. This release includes many security fixes of various levels of severity. We recommend all users upgrade to this release immediately. For full information on the vulnerabilities fixed and mitigation factors for users who are...

SUSE SLES11 Security Update : mysql (SUSE-SU-2017:0408-1)

This mysql version update to 5.5.54 fixes the following issues : - CVE-2017-3318: Unspecified vulnerability affecting Error Handling bsc1020896 - CVE-2017-3317: Unspecified vulnerability affecting Logging bsc1020894 - CVE-2017-3313: Unspecified vulnerability affecting the MyISAM component...

Oracle Linux 6 / 7 : ntp (ELSA-2017-0252)

The remote Oracle Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2017-0252 advisory. - don't limit rate of packets from sources CVE-2016-7426 - don't change interface from received packets CVE-2016-7429 - fix calculation of root...

Oracle Linux 7 : spice (ELSA-2017-0254)

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2017-0254 advisory. - Fix buffer overflow in mainchannelallocmsgrcvbuf when reading large messages. Resolves: CVE-2016-9577 Tenable has extracted the preceding description...

Ubuntu 16.10 : linux vulnerabilities (USN-3190-1)

Mikulas Patocka discovered that the asynchronous multibuffer cryptographic daemon mcryptd in the Linux kernel did not properly handle being invoked with incompatible algorithms. A local attacker could use this to cause a denial of service system crash. CVE-2016-10147 It was discovered that a...

SUSE SLED12 / SLES12 Security Update : libxml2 (SUSE-SU-2017:0380-1)

This update for libxml2 fixes the following issues : - CVE-2016-4658: use-after-free error could lead to crash bsc1005544 - Fix NULL dereference in xpointer.c when in recovery mode bsc1014873 - CVE-2016-9597: An XML document with many opening tags could have caused a overflow of the stack not...

Oracle Linux 6 : spice-server (ELSA-2017-0253)

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2017-0253 advisory. - Fix buffer overflow in mainchannelallocmsgrcvbuf when reading large messages. Resolves: CVE-2016-9577 Tenable has extracted the preceding description...

Ubuntu 14.04 LTS : Linux kernel vulnerability (USN-3188-1)

The remote Ubuntu 14.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-3188-1 advisory. Andrey Konovalov discovered that the SCTP implementation in the Linux kernel improperly handled validation of incoming data. A remote attacker could use this to...

Ubuntu 16.04 LTS : NTFS-3G vulnerability (USN-3182-1)

The remote Ubuntu 16.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-3182-1 advisory. Jann Horn discovered that NTFS-3G incorrectly filtered environment variables when using the modprobe utility. A local attacker could possibly use this issue to lo...

CVE-2016-9260

Cross-site scripting XSS vulnerability in Tenable Nessus before 6.9 allows remote authenticated users to inject arbitrary web script or HTML via vectors related to handling of .nessus files...

CVE-2016-9260

Cross-site scripting XSS vulnerability in Tenable Nessus before 6.9 allows remote authenticated users to inject arbitrary web script or HTML via vectors related to handling of .nessus files...

CVE-2016-9260

CVE-2016-9260 is a stored cross-site scripting (XSS) vulnerability affecting Tenable Nessus prior to version 6.9. The issue arises in how Nessus handles .nessus files, allowing an authenticated, remote attacker to inject arbitrary script/HTML into a user's browser session. Public documents consis...

Fedora 24 : python-crypto (2017-08207fe48b)

A heap-buffer overflow vulnerability was discovered in pycrypto leading to arbitrary code execution. All users of pycrypto's AES module that allow the mode of operation to be specified by an attacker, check for ECB explicitly and create the objects without specifying an IV are vulnerable to this...

Fedora 25 : python-crypto (2017-7c569d396b)

A heap-buffer overflow vulnerability was discovered in pycrypto leading to arbitrary code execution. All users of pycrypto's AES module that allow the mode of operation to be specified by an attacker, check for ECB explicitly and create the objects without specifying an IV are vulnerable to this...

SUSE SLES11 Security Update : gnutls (SUSE-SU-2017:0304-1)

This update for gnutls fixes the following issues : - Malformed asn1 definitions could cause a segmentation fault in the asn1 definition parser bsc961491. - CVE-2016-8610: Remote denial of service in SSL alert handling bsc1005879. - CVE-2017-5335: Decoding a specially crafted OpenPGP certificate...

Fedora 25 : ghostscript (2017-15f85f1cf1)

This is a security update for these CVEs : - CVE-2016-9601 - Heap-buffer overflow in jbig2imagenew function This update also solves possible licensing issues with ghostscritpt's source code. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora...